Sign-up

ID

VAR-201904-0570


CVE

CVE-2018-14999


TITLE

Leagoo P1 Device permission vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-015353

DESCRIPTION

The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform app with a package name of com.wtk.factory (versionCode=1, versionName=1.0) that contains an exported broadcast receiver named com.wtk.factory.MMITestReceiver allows any app co-located on the device to programmatically initiate a factory reset. In addition, the app initiating the factory reset does not require any permissions. A factory reset will remove all user data and apps from the device. This will result in the loss of any data that have not been backed up or synced externally. The capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves with the exception of enabled Mobile Device Management (MDM) apps), although this capability can be obtained by leveraging an unprotected app component of a pre-installed platform app. Leagoo P1 The device contains a permission vulnerability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. Leagoo P1 is a smart phone based on Android platform produced by Leagoo Technology Company of China. There is a security vulnerability in the com.wtk.factory package (versionCode=1, versionName=1.0) in Leagoo P1 (build fingerprint is sp7731c_1h10_32v4_bird: 6.0/MRA58K/android.20170629.214736: user/release-keys). Attackers can exploit this vulnerability to restore factory settings without permission, resulting in data loss

Trust: 1.71

sources: NVD: CVE-2018-14999 // JVNDB: JVNDB-2018-015353 // VULHUB: VHN-125214

AFFECTED PRODUCTS

vendor:leagoomodel:p1scope:eqversion: -

Trust: 1.0

vendor:leagoo globalmodel:p1scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2018-015353 // NVD: CVE-2018-14999

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-14999
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-14999
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201904-1184
value: CRITICAL

Trust: 0.6

VULHUB: VHN-125214
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-14999
severity: HIGH
baseScore: 9.4
vectorString: AV:N/AC:L/AU:N/C:N/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-125214
severity: HIGH
baseScore: 9.4
vectorString: AV:N/AC:L/AU:N/C:N/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 9.2
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-14999
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.2
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-125214 // JVNDB: JVNDB-2018-015353 // CNNVD: CNNVD-201904-1184 // NVD: CVE-2018-14999

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-275

Trust: 0.9

sources: VULHUB: VHN-125214 // JVNDB: JVNDB-2018-015353 // NVD: CVE-2018-14999

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201904-1184

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201904-1184

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-015353

PATCH
title:P1url:https://www.leagoo.com/products/P1/spec.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-015353

EXTERNAL IDS
db:NVDid:CVE-2018-14999
Trust: 2.5
db:JVNDBid:JVNDB-2018-015353
Trust: 0.8
db:CNNVDid:CNNVD-201904-1184
Trust: 0.7
db:VULHUBid:VHN-125214
Trust: 0.1
sources:
            
            
            VULHUB: VHN-125214 // 
            
            
            
            JVNDB: JVNDB-2018-015353 // 
            
            
            
            CNNVD: CNNVD-201904-1184 // 
            
            
            
            NVD: CVE-2018-14999

REFERENCES
url:https://www.kryptowire.com/portal/android-firmware-defcon-2018/
Trust: 1.7
url:https://www.kryptowire.com/portal/wp-content/uploads/2018/12/defcon-26-johnson-and-stavrou-vulnerable-out-of-the-box-an-eval-of-android-carrier-devices-wp-updated.pdf
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-14999
Trust: 1.4
url:https://www.kryptowire.com
Trust: 1.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14999
Trust: 0.8
url:https://www.kryptowire.com/android-firmware-defcon-2018/
Trust: 0.8
sources:
            
            
            VULHUB: VHN-125214 // 
            
            
            
            JVNDB: JVNDB-2018-015353 // 
            
            
            
            CNNVD: CNNVD-201904-1184 // 
            
            
            
            NVD: CVE-2018-14999

SOURCES
db:VULHUBid:VHN-125214
db:JVNDBid:JVNDB-2018-015353
db:CNNVDid:CNNVD-201904-1184
db:NVDid:CVE-2018-14999

LAST UPDATE DATE
2024-11-23T22:21:43.499000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-125214date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2018-015353date:2019-05-29T00:00:00
db:CNNVDid:CNNVD-201904-1184date:2020-08-25T00:00:00
db:NVDid:CVE-2018-14999date:2024-11-21T03:50:18.560

SOURCES RELEASE DATE
db:VULHUBid:VHN-125214date:2019-04-25T00:00:00
db:JVNDBid:JVNDB-2018-015353date:2019-05-29T00:00:00
db:CNNVDid:CNNVD-201904-1184date:2019-04-25T00:00:00
db:NVDid:CVE-2018-14999date:2019-04-25T20:29:01.397